CVE-2026-84697

Executive Summary

CVE-2026-84697 is a server-side request forgery (SSRF) vulnerability in Mailpit's internal-IP deny list logic. The IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the IPv4-translated IPv6 prefix defined by RFC 2765/6145, allowing an unauthenticated remote attacker to reach internal destinations through Mailpit's link check API and proxy endpoint. The vulnerability is exposed on network-facing Mailpit instances, enables limited—yet sensitive—internal resource disclosure (CVSS 3.1 base score 5.3), and currently has no vendor patch, exploit code, or CISA KEV listing.

Technical Analysis

The root cause of CVE-2026-84697 is an incomplete IP address filtering routine within Mailpit's anti-SSRF protection layer. The relevant function, IsInternalIP, is responsible for evaluating whether a given destination address is loopback, link-local, private, or otherwise reserved before allowing Mailpit's link check API and proxy functionality to initiate outbound connections to it. The deny list is intended to prevent requests to internal network resources. However, two address categories are omitted from the filter:

1. Azure WireServer IP address — 168.63.129.16. Azure reserves this address as a virtual IP for the host's WireServer, which provides metadata, health probes, and DHCP feedback for Azure VMs. Because 168.63.129.16 is not in the private IPv4 ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), a naively implemented private-IP deny list will not block it. If Mailpit is deployed inside Azure, a successful request to this address can expose the instance's metadata service, which may contain management certificates, SSH public keys, and provisioning credentials.

2. RFC 2765 / RFC 6145 IPv4-translated IPv6 prefix — These standards define the well-known prefix 64:ff9b::/96, used for stateless translation between IPv4 and IPv6 (NAT64). An attacker who controls DNS resolution can supply a hostname that resolves to an IPv6 address within 64:ff9b::/96 (e.g., 64:ff9b::a00:0 mapping to 10.0.0.0). If the deny list checks only literal IPv4 ranges and does not translate or recognize the embedded IPv4 address inside the IPv6 prefix, the request bypasses the filter and reaches the internal IPv4 destination.

The attack surface is two-fold per the NVD description: (a) the link check API, which fetches URLs embedded in email content to validate links, and (b) the proxy endpoint, which presumably allows authorized users to proxy/originate requests to URLs. Both features inherently perform outbound HTTP(S) fetches on behalf of the user. In Mailpit's architecture, message content (emails) can contain arbitrary hostnames; when a message is processed or a user interacts with a "check links" feature, the application resolves the hostname and performs the connection. Since DNS resolution is attacker-controllable (hostnames resolving to these addresses), the attacker does not need to bypass DNS-level restrictions—they merely register or control a domain with an appropriate A or AAAA record pointing at 168.63.129.16 or an IPv6 address in the translated prefix.

The vulnerability class is a classic SSRF (CWE-918) arising from an incomplete allow/deny boundary check at the application layer. No authentication is required (PR:N), the attack can be performed over the network (AV:N), and there is no user interaction (UI:N). The security scope is unchanged (S:U) because the compromised resource is the Mailpit service itself, and confidentiality impact is low (C:L)—limited to information disclosure from the reachable internal service, not full data corruption or integrity loss.

CVSS vector breakdown: Attack Vector: Network; Attack Complexity: Low; Privileges Required: None; User Interaction: None; Scope: Unchanged; Confidentiality: Low; Integrity: None; Availability: None. Base score 5.3 (Medium).

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit code is currently available; the steps below represent the plausible exploitation sequence at the class level.

1) Reconnaissance / Target Identification — The attacker scans the internet for exposed Mailpit web interfaces (commonly on port 8025 for the UI and 1025 for SMTP, though port numbers are not confirmed for this CVE). Shodan queries such as http.title:"Mailpit" or product:"Mailpit" can locate instances. The attacker then determines whether the instance offers a link-check API or a proxy endpoint—these are accessible via the unauthenticated UI or API surface described in the NVD entry.

2) Triggering the Flaw — The attacker crafts a mail message (or otherwise supplies content) containing a URL whose hostname resolves to either 168.63.129.16 (Azure WireServer) or to an IPv6 address within the 64:ff9b::/96 NAT64 prefix that embeds an internal IPv4 target (e.g., 10.0.0.5, 172.16.1.1). The attacker controls DNS, so no network-level filtering is bypassed—the resolution itself is legitimate. For the link check API, the attacker either sends the message through Mailpit’s SMTP intake or directly invokes the link-checking routine on previously injected content. For the proxy endpoint, the attacker supplies the malicious URL directly.

3) Payload / Execution Method — When Mailpit's IsInternalIP deny list evaluates the resolved IP, it fails to match the Azure WireServer address (not in the private range) or fails to decode the embedded IPv4 from the IPv6-translated prefix. Consequently, the application performs an HTTP GET (or similar request) to the internal destination. Example destination patterns include:

• http://168.63.129.16/?metadata=... — retrieving Azure instance metadata.
• http://[64:ff9b::a00:1]/internal/service — reaching an internal web application via NAT64.

The link check API, by design, fetches the URL and reports status/content back to the Mailpit UI, thereby disclosing the response to the authenticated-in-the-session user (who, per PR:N, may be unauthenticated).

4) Post-Exploitation Impact — The attacker reads the HTTP response body from the internal resource. In a default Azure VM deployment, the WireServer metadata endpoint exposes cloud-init scripts, SSH public keys, and managed identity tokens. Accessing internal web applications through the NAT64 prefix may reveal login pages, internal APIs, or configuration files. Because the scope is unchanged and the confidentiality impact is low, the attacker cannot directly modify data or execute code—but harvested account tokens, API keys, or sensitive configuration data can be used for lateral movement in follow-on attacks.

Note: No public PoC exists. The chain above is representative of the SSRF class and is grounded in the NVD description’s mention of the link check API, proxy endpoint, hostname resolution, and the two bypassed address ranges.

Impact Assessment

Business Impact: Mailpit is a development/testing mail server used widely in CI/CD pipelines and developer environments. The flaw transforms a trusted internal-only tool into a proxy for probing cloud metadata and internal networks. In enterprise settings where Mailpit is exposed accidentally (misconfiguration) or intentionally (shared development environments, observability dashboards), the risk is real but bounded: the attacker can only read data (confidentiality loss, low severity) and cannot tamper with or destroy data.

Affected Systems: Network-exposed Mailpit instances, especially those deployed on Azure VMs (due to the WireServer vector) or in dual-stack IPv4/IPv6 networks (due to the NAT64 prefix). The flaw affects any deployment where the link check API or proxy endpoint is enabled and where outbound egress to internal ranges is not separately restricted by host-level firewall rules.

Blast Radius: Confined to the Mailpit host’s network reachability. If Mailpit runs in a container with host-network access inside a cloud VPC, the SSRF could reach internal servers (databases' admin panels, internal CI servers, configuration management endpoints). The CVSS scope is unchanged (S:U), signaling the compromised component and the impacted component are the same—Mailpit is both the vulnerability target and the source of the disclosure—so no cross-component privilege escalation is inherent. Estimated EPSS is not yet available; given the niche product and lack of exploit code, widespread in-the-wild exploitation is unlikely in the short term.

Detection Guidance

Sigma Rule

title: Mailpit SSRF - Internal Address Bypass via Azure WireServer or NAT64 Prefix
id: 9b3e8c51-4d7a-4f2c-b998-24a1f0d9e6c2
status: experimental
description: Detects HTTP requests to Azure WireServer IP 168.63.129.16 or to IPv6 addresses in the 64:ff9b::/96 NAT64 prefix, potentially indicating SSRF exploitation against Mailpit.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-84697
author: Valtersit Threat Intel
date: 2026/06/01
logsource:
    category: webserver
    product: generic
detection:
    selection_wireserver:
        cs-uri-query|contains:
            - '168.63.129.16'
        cs-host|contains:
            - '168.63.129.16'
    selection_nat64:
        cs-host|startswith:
            - '64:ff9b:'
        cs-uri-query|startswith:
            - '64:ff9b:'
    condition: selection_wireserver or selection_nat64
falsepositives:
    - Legitimate administrative tools checking Azure health endpoints
    - NAT64 test traffic generated by network operations
level: high

YARA Rule

rule Mailpit_SSRF_Internal_IP_Bypass
{
    meta:
        description = "Detects request patterns in logs targeting Azure WireServer or NAT64-translated IPv6 internal addresses associated with CVE-2026-84697"
        author = "Valtersit Threat Intel"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84697"
        severity = "high"

    strings:
        $wireserver = "168.63.129.16"
        $nat64a = "64:ff9b::"
        $nat64b = "[64:ff9b:"
        $nat64c = "64:ff9b:0:"
        $http_get = "GET /"
        $link_endpoint = "linkcheck"
        $proxy_endpoint = "proxy"

    condition:
        (
            $wireserver
            or
            $nat64a or $nat64b or $nat64c
        )
        and
        (
            $http_get
            or
            filesize < 200KB
        )
        and
        (
            $link_endpoint or $proxy_endpoint or filesize < 100KB
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84697 Mailpit SSRF - Destination Azure WireServer IP"; flow:established,to_server; content:"Host|3a|"; http_header; content:"168.63.129.16"; nocase; http_host; sid:10000001; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-84697;)

alert http any any -> any any (msg:"CVE-2026-84697 Mailpit SSRF - Destination NAT64 Translated IPv6 Prefix"; flow:established,to_server; content:"Host|3a|"; http_header; content:"64:ff9b"; nocase; http_host; sid:10000002; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-84697;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where destination.ip == "168.63.129.16"
     and network.direction : "egress"] 
  [network where cidrMatch(destination.ip, "64:ff9b::/96")]   // Note: EQL cidrMatch may not support IPv6 in all versions; use URL-based fallback

Note: For Elastic versions where cidrMatch lacks IPv6 support, an alternative URL-based rule is provided below.

sequence by source.ip with maxspan=5m
  [http where url.domain : "*168.63.129.16*"] 
  [http where url.domain : "64:ff9b*" or url.domain : "*[64:ff9b*"]

Splunk SPL Query

index=proxy OR index=web sourcetype="access_combined" OR sourcetype="iis"
| where match(url, "(?i)168\.63\.129\.16") OR match(url, "(?i)64:ff9b")
| table _time, src_ip, dest_ip, url, status, user_agent, host
| rename src_ip as "Source IP", dest_ip as "Destination IP", url as "Requested URL"
| sort - _time

Alternative: For M365/Azure egress samples:

index=azure_monitor OR index=firewall
| search "168.63.129.16" OR "64:ff9b" OR "64:FF9B"
| table TimeGenerated, SourceIP, DestinationIP, DestinationPort, Action

Wazuh OSSEC Rule

<rule id="100846" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.168\.63\.129\.16|168\.63\.129\.16</field>
    <description>Mailpit SSRF attempt detected - Request to Azure WireServer IP (CVE-2026-84697)</description>
    <group>ssrf,mailpit,cve-2026-84697,attck.t1190,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

<rule id="100847" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">64:ff9b</field>
    <description>Mailpit SSRF attempt detected - Request to NAT64 translated prefix (CVE-2026-84697)</description>
    <group>ssrf,mailpit,cve-2026-84697,attck.t1190,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, patch commit, or official advisory has been identified from any tracked source as of the time of this report. The affected version range cannot be bounded, and no updated Mailpit build has been announced. The following guidance is therefore provisional.

1) Immediate Mitigations (compensating controls)

• Network egress filtering: Block outbound traffic from the Mailpit host to 168.63.129.16 and to IPv6 destinations within 64:ff9b::/96 at the host firewall or cloud security group, unless a verified business need exists.
• Disable unnecessary features: If the link check API and proxy endpoint are not required in the production/deployment environment, disable them via Mailpit configuration to eliminate the SSRF trigger surface.
• Restrict access: Move Mailpit behind an authentication proxy and restrict network exposure to trusted internal CIDRs only. Do not expose the UI or SMTP interface to the internet.
• Reverse proxy controls: If Mailpit must be exposed, place it behind a web application firewall (WAF) or reverse proxy that inspects URL parameters and blocks requests referencing 168.63.129.16 or 64:ff9b in the absolute URI.

2) Patch / Upgrade Steps

• Monitor the official Mailpit repository (GitHub: axllent/mailpit) and the project’s release notes for a security fix addressing IP filtering completeness.
• When a patched version is released, upgrade immediately. Until then, treat the current build as compromised-eligible and apply all compensating controls above.
• After patching, verify that the IsInternalIP function correctly rejects 168.63.129.16 and resolves RFC 2765/6145 IPv6 prefixes to their embedded IPv4 destination before making an allow/deny decision.

3) Long-Term Hardening

• Run Mailpit in a containerized environment with a minimal network namespace and no route to cloud metadata IPs (e.g., set 169.254.169.254 and 168.63.129.16 as blackhole routes in iptables/nftables).
• Implement a security gate in CI to test the upstream project’s security posture before deployment; subscribe to the project’s GitHub security advisories or the NVD feed.
• Adopt a denylist-plus-allowlist architecture for any outbound URL-fetching code: verify that resolved IPs are both non-internal and non-reserved, including public cloud metadata IPs and translated IPv6 ranges.
• Perform periodic external SSRF assessments against any network-facing web service that supports URL fetching.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-84697
2. Mailpit Official Repository (for future patch announcements) — https://github.com/axllent/mailpit
3. RFC 2765 — Stateless IP/ICMP Translation Algorithm (SIIT) — https://www.rfc-editor.org/rfc/rfc2765
4. RFC 6145 — IP/ICMP Translation Algorithm — https://www.rfc-editor.org/rfc/rfc6145
5. Microsoft Azure — Azure WireServer IP address documentation — https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None identified at this time. CISA KEV does not list this CVE, and no public exploit code, Nuclei template, or Metasploit module exists. Monitoring should continue as the unpatched status increases the likelihood of a future PoC.